Step 2: Create a Role and Three Users for the Oracle Label Security Tutorial

You are ready to create a role and three users, and then grant these users the role.

• Creating a Role

• Creating the Users

Creating a Role

The emp_role role provides the necessary privileges for the three users you will create.

To create the role emp_role: 

1. Connect to Database Control as user SYSTEM.

2. From the Database Home page, click Server to display the Server subpage.

3. In the Security section, click Roles.

   The Roles page appears.

4. Click Create.

   The Create Role page appears.

5. In the Name field, enter EMP_ROLE and leave Authentication set to None.

6. Select the Object Privileges subpage.

7. From the Select Object Type list, select Table, and then click Add.

   The Add Table Object Privileges page appears.

8. Under Select Table Objects, enter HR.LOCATIONS to select the LOCATIONS table in the HR schema, and then under Available Privileges, move SELECT to the Selected Privileges list.

9. Click OK to return to the Create Role page, and then click OK to return to the Roles page.

Creating the Users

The three users you create will have different levels of access to the HR.LOCATIONS table, depending on their position. Steven King (sking) is the advertising president, so he has full read access to the HR.LOCATIONS table. Karen Partners (kpartner) is a sales manager who has less access, and Louise Doran (ldoran) is a sales representative who has the least access.

To create the users: 

1. Ensure that you are logged in to Database Control as SYSTEM.

   If you are not already logged in as SYSTEM, then select Logout, and then select Login. In the Login page, enter SYSTEM and the password assigned to that account. Set Connect As to Normal. Select Login to log in.

   If you are logged in as SYSTEM, click the Database Instance link to display the home page.

2. Click Server to display the Server subpage.

3. In the Security section, click Users.

   The Users page appears.

4. Click Create.

   The Create User page appears.

5. Enter the following information:

   • Name: SKING

   • Profile: DEFAULT

   • Authentication: Password

   • Enter Password and Confirm Password: Enter a password that meets the requirements in "Requirements for Creating Passwords".

   • Default Tablespace: USERS

   • Temporary Tablespace: TEMP

   • Status: Set to Unlocked.

   • Roles: Select the Roles subpage, and then grant the emp_role role to sking by selecting Edit List. From the Available Roles list, select emp_role, and then click Move to move it to the Selected Roles list. Click OK. In the Create User page, ensure that the Default box is selected for both the CONNECT and emp_role roles.

   • System Privileges: Select the System Privileges subpage and then click Edit List to grant the CREATE SESSION privileges. Do not grant sking the ADMIN OPTION option.

6. Click OK to return to the Create User page, and then from there, click OK to return to the Users page.

7. In the Users page, select SKING, set Actions to Create Like, and then click Go.

   The Create User page appears.

8. Create accounts for kpartner and ldoran.

   Create their names and passwords. (See "Requirements for Creating Passwords".) You do not need to grant roles or system privileges to them. Their roles and system privileges, defined in the sking account, are automatically created.

At this stage, you have created three users who have identical privileges. All of these users have the SELECT privilege on the HR.LOCATIONS table, through the EMP_ROLE role.